Remove XML elements via transforms (keep the tags)

evdent — Fri, 04 Dec 2020 06:58:57 GMT

Hi,

I am trying to remove elements from XML in a log file using the heavy forwarder via transforms.conf

Tried several variants, this one has come close but is only creating a single instance of what its found

e.g <name>REDACTED<name>

Current

Transforms.conf

[redact_xml]
REGEX = <(.*)>[^<]*<\/\1>
FORMAT = <$1>REDACTED<$1>
DEST_KEY = _raw

Example, the log file might have:

<?xml version="1.0" encoding="UTF-8"?> <breakfast_menu> <food><name>Belgian Waffles</name><price>$5.95</price><description> Two of our famous Belgian Waffles with plenty of real maple syrup </description><calories>650</calories> </food> <food><name>Strawberry Belgian Waffles</name><price>$7.95</price><description>Light Belgian waffles covered with strawberries and whipped cream</description><calories>900</calories> </food> <food><name>Berry-Berry Belgian Waffles</name><price>$8.95</price><description>Belgian waffles covered with assorted fresh berries and whipped cream</description><calories>900</calories> </food> <food><name>French Toast</name><price>$4.50</price><description>Thick slices made from our homemade sourdough bread</description><calories>600</calories> </food> <food><name>Homestyle Breakfast</name><price>$6.95</price><description>Two eggs, bacon or sausage, toast, and our ever-popular hash browns</description><calories>950</calories> </food> </breakfast_menu>

And I want to push into splunk the redacted version

<?xml version="1.0" encoding="UTF-8"?> <breakfast_menu> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> </breakfast_menu>

topic Remove XML elements via transforms (keep the tags) in Getting Data In

Remove XML elements via transforms (keep the tags)